                   [:p
                    [:label {:for "password"} "Password"]
                    [:input {:name "password" :id "password" :type "password"}]]
-
-                  ;; TODO - Hidden fields - I think we should first
-                  ;; redirect to a oauth2 handler which validates the
-                  ;; request, if the request is valid, then tries to
-                  ;; authenticate the user against an existing session,
-                  ;; if no existing session then redirects to a login
-                  ;; form such as this. Then we wouldn't need to 'hide'
-                  ;; these fields in the form.
-                  [:input {:name "client_id" :type "hidden" :value (-> req :query-params (get "client_id"))}]
-                  [:input {:name "scope" :type "hidden" :value (-> req :query-params (get "scope"))}]
-                  [:input {:name "state" :type "hidden" :value (-> req :query-params (get "state"))}]
-
                   [:p [:input {:type "submit"}]]
                   [:p [:a {:href (path-for (:modular.bidi/routes req) :cylon.impl.signup/signup-form)} "Signup"]]]])})
       wrap-params)

   [org.httpkit.client :refer (request) :rename {request http-request}]
   [cheshire.core :refer (encode decode-stream)]
   [cylon.authorization :refer (Authorizer)]
   [cylon.session :refer (create-session! get-session assoc-session!)]
   [ring.middleware.cookies :refer (wrap-cookies cookies-request cookies-response)]
   [ring.util.codec :refer (url-encode)]
   [schema.core :as s]
   [cylon.user :refer (verify-user)]
   [cylon.session :refer (create-session! assoc-session! ->cookie get-session-value get-cookie-value)]
   [cylon.totp :refer (OneTimePasswordStore get-totp-secret totp-token)]
   [clj-jwt.core :refer (to-str jwt sign str->jwt verify encoded-claims)]
   [clj-time.core :refer (now plus days)]

                  (:session-store this)
                  (-> req cookies-request :cookies (get "session-id") :value))]
          ;; TODO Obey the 'prompt' value in OpenID/Connect
          (do
            (infof "Hi - it appears you're already logged in, session is %s" (pr-str session))
            {:status 302
             :headers {"Location" (path-for (:modular.bidi/routes req) ::get-authenticate-form)}})
          (let [session (create-session!
                         (:session-store this)
                         {:client-id (-> req :query-params (get "client_id"))
                          :scope (-> req :query-params (get "scope"))
                          :state (-> req :query-params (get "state"))
                          })]
            (infof "Hi - it appears you're not already logged in, so I'm going to create a session for you and redirect you")
            (cookies-response
                      {:status 302
                       :headers {"Location" (path-for (:modular.bidi/routes req) ::get-authenticate-form)}
                       :cookies {"session-id" (->cookie session)}}))))
         wrap-params)

     ::get-authenticate-form
